Amaury Levé 54cdb7ebca Add skill-coverage PR workflow with slash command support (#538) ...

* Add skill-coverage PR workflow with slash command support

- Auto-triggers on PRs that change plugins/** or tests/**
- Detects specific plugin/skill pairs from the PR diff
- Runs Measure-SkillCoverage.ps1 and posts a coverage report as a PR comment
- Supports /skill-coverage slash command on PR comments:
  /skill-coverage              (runs on changed skills in the PR)
  /skill-coverage <plugin>     (runs on all skills in the plugin)
  /skill-coverage <plugin> <skill>  (runs on a specific skill)

* Address Copilot review: security, permissions, and robustness fixes

- Add permission check: require write access before running slash command
- Tighten /skill-coverage matching to avoid false triggers on similar commands
- Add issues: write permission (PR comments use Issues API)
- Use refs/pull/<num>/head for checkout to support fork PRs
- Remove unused \ variable
- Fix multi-line JSON parsing with Out-String

* Address PR #538 review: fork PR handling, reactions, and sourcing note

- Skip PR comment posting for fork PRs (read-only token); coverage still runs in step summary
- Add continue-on-error to reaction step to avoid 403 failures
- Add header comment noting issue_comment trigger sources from default branch
- Add continue-on-error to no-changes comment step

* Split into analyze + comment jobs; fix pagination and dedup

Security:
- Split into two jobs: analyze (contents: read only) and comment (write only)
- Analyze job checks out base branch for trusted tooling, PR head into
  a separate git worktree - untrusted PR code is never executed
- Comment job only reads an uploaded artifact, no PR code checkout

Fixes:
- Use github.paginate() for listComments to handle PRs with >100 comments
- Deduplicate targets: plugin-wide changes replace per-skill targets for
  that plugin instead of producing duplicates

2026-04-17 12:55:33 +02:00

15 KiB

Raw Permalink Blame History

View Raw